[Bug] Fork pull request workflows cannot check out skill submissions

[GCrapuzzi]

Describe the bug

Both fork-facing validation workflows fail at the checkout step before inspecting the submitted skill. actions/checkout now refuses to check out fork code from a pull_request_target workflow unless the workflow explicitly opts into the risk.

To Reproduce:

1. Open a pull request from a fork, for example Add Talamus local-first memory skill #58.
2. Wait for Validate Skills and Skills Security Scan.
3. Open either failed run.
4. The 'Checkout PR head into ./pr (untrusted)' step stops with: 'Refusing to check out fork pull request code from a pull_request_target workflow.'

Expected behavior:

Fork submissions should be checked out in a safe, read-only context and validated by trusted base-repository code, with results reported on the PR.

Supporting Material

• Validate Skills failure: https://github.com/block/agent-skills/actions/runs/29828148825
• Skills Security Scan failure: https://github.com/block/agent-skills/actions/runs/29828148853
• Example fork submission: Add Talamus local-first memory skill #58

The exact submitted commit independently passes the repository's structure validator on an LF checkout, and the security scanner report is PASS with zero failures and zero warnings. The hosted workflows fail before either result can be produced.

Environment

• OS: GitHub-hosted Ubuntu runner
• Workflow trigger: pull_request_target
• Checkout action: actions/checkout@v4

Additional context

The validation workflow currently executes scripts/validate-skills.mjs from the fork checkout because its working directory is pr. A fix should retain the security boundary and avoid executing fork-modified validator code with the base repository token; merely bypassing the checkout safeguard without restructuring would preserve the pwn-request risk.